Is it legal to cold email or DM people about my product?

What the regulators say, in their own words

The UK rules are the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, enforced by the Information Commissioner's Office (ICO). The US rule is the CAN SPAM Act, enforced by the Federal Trade Commission (FTC).

Regulation 22 applies only to individual subscribers, which is why companies fall outside it. The exception a business can use, which the ICO calls the soft opt in, is for someone whose details you obtained in the course of a sale or negotiations for a sale. The ICO says it does not apply to prospective customers or new contacts, so it cannot cover a cold message.

The same guide says the law makes no exception for email sent from one business to another.

The UK and the US, side by side

Read from the three pages quoted above and from regulation 23. The penalties are sourced under "The numbers".

What that means if you have just launched

This page covers the UK and the US only, does not say which country's rules apply to a message sent across a border, and is not legal advice. Other countries have their own rules: the Canadian government's page on its anti spam legislation says it asks businesses to obtain consent before sending commercial electronic messages.

• In the UK, find out who you are writing to. A limited company may be emailed cold. A sole trader or an ordinary partnership may not. If you cannot tell which it is, the ICO says to treat the address as belonging to an individual.
• A named person at a company is still personal data. The ICO's legitimate interests guidance says much of what you do with business contacts' details is likely to be lawful on that basis, that there is no absolute rule, and that you must apply its three part test. It cannot be used where PECR requires consent. The page on business to business marketing says to give the person privacy information no later than one month after you took their details from another source.
• Direct messages are covered in the UK. The ICO's page on business to business marketing counts a direct message on social media as electronic mail, so a pitch sent that way to an individual needs their consent first. It adds that marketing sent to a person who uses a professional networking site in their personal, albeit professional, capacity is not business to business marketing. The FTC's guide does not mention direct messages. Platforms set their own limits: see LinkedIn and X.
• Public does not mean consented. The ICO's detailed guidance says publicly available contact details are not consent to your marketing, and that people on a bought list must have given valid consent that named your organisation.
• One message counts. Neither set of rules is only about bulk sending. The ICO says direct marketing covers all types of advertising, marketing or promotional material, and the FTC's guide says the Act does not apply just to bulk email.

The numbers

• UK maximum: £17,500,000, or 4% of turnover. Since 5 February 2026, Schedule 1 of the Regulations puts regulations 22 and 23 under the higher maximum amount in section 157 of the Data Protection Act 2018: £17,500,000 or, for an undertaking, 4% of total annual worldwide turnover in the preceding financial year, whichever is higher. The Schedule also allows a penalty notice to a company officer, such as a director, whose consent, connivance or neglect lay behind the failure.
• One ICO page still says £500,000. The ICO's summary of the Data (Use and Access) Act 2025 says the Act brings enforcement under PECR into line with UK GDPR, so that penalties are the same in most cases. Its introduction to PECR still says a fine of up to £500,000, under a notice that the page is under review because of the Act.
• US maximum: $53,088 for each separate email. The figure on the FTC's guide today, which carries a note that it was edited in January 2024 for the civil penalty maximums.
• 0.3% and 5,000. A mailbox provider's own rule, on top of the law. Google's email sender guidelines require every sender to personal Gmail accounts to authenticate their email and keep reported spam rates below 0.3%. Above 5,000 messages a day to Gmail accounts, marketing messages must also offer unsubscribing in one click.

How Sami uses it

Sami ranks cold email and direct messages against the other channels for your product, such as Reddit and directories, and says why they are in or out. Sending a message needs no ad budget, so the channel is weighed with the free methods, which the plan puts before paid ones.

AskSami never posts anywhere for you, never spends your money and never writes to your code. You do those things yourself. That covers email and direct messages: every one is sent by you. The numbers you bring back, such as messages sent, replies and signups, become dated records.